ProtocolFilters

ProtocolFilters is a library that classifies data packets provided on input, detects high-level protocols and allows filtering of the classified objects. It is designed to work with the NetFilter SDK API, but can also be used for parsing and filtering network packets obtained from other sources. The library has a simple API, which can be used from C/C++/.NET/Delphi code. The library is cross-platform. It can be used on Windows, Linux and macOS.

Key features

• The library supports filtering the following protocols: TLS/SSL, HTTP, HTTP/2, POP3, SMTP, IMAP, FTP, XMPP, WebSocket and raw data.

• The protocol is detected automatically by analyzing the first packets. Unsupported protocols are bypassed automatically. It is possible to configure the library to classify all outgoing network traffic and filter only the classified protocols.

• Proxy filter detects HTTPS, SOCKS v4/4a/5 proxies, including chained requests.

• HTTP and HTTP/2 filters decode the transmitted requests and responses, and allow filtering of plain de-chunked and uncompressed HTTP data. It is possible to bypass filtering or block a request or response by analyzing the initial bytes of the transmitted content.

• SSL filter decodes SSL v2/3 and TLS by generating a local certificate for each domain, i.e. it uses the MITM method.

• The filters for POP3, SMTP, IMAP protocols allow filtering the mail messages.

• FTP protocol filter allows monitoring and modifying FTP commands, responses and transmitted data.

• XMPP filter allows monitoring/modifying/blocking Jabber commands and responses.

• It is possible to filter the unclassified content as raw buffers.

• The filtering chain with protocol filters is created dynamically for each new connection. It is possible to apply different chains of filters with different filtering flags for connections after analyzing connection properties: process identifier, name and owner, local and remote addresses/ports.

• Using API
• Configurations
• I found a bug
• Frequently asked questions
• API reference
  • Functions
    • pf_init()
    • pf_free()
    • pf_getNFEventHandler()
    • pf_postObject()
    • pf_addFilter()
    • pf_deleteFilter()
    • pf_getFilterCount()
    • pf_isFilterActive()
    • pf_setRootSSLCertSubject()
    • pf_setRootSSLCertSubjectEx()
    • pf_loadCAStore()
    • pf_getRootSSLCertFileName()
    • pf_setExceptionsTimeout()
    • pf_deleteExceptions()
    • pf_setRootSSLCertImportFlags()
    • pf_getProcessOwnerA()
    • pf_getProcessOwnerW()
    • PFObject_create()
    • pf_readHeader()
    • pf_writeHeader()
    • pf_unzipStream()
    • pf_waitForImportCompletion()
    • pf_startLog()
    • pf_stopLog()
    • pf_loadOpenSSLEngine()
    • pf_assignFile()
  • Classes
    • PFEvents
      • threadStart()
      • threadEnd()
      • tcpConnectRequest()
      • tcpConnected()
      • tcpClosed()
      • udpCreated()
      • udpConnectRequest()
      • udpClosed()
      • dataAvailable()
      • dataPartAvailable()
      • tcpPostSend()
      • tcpPostReceive()
      • tcpSetConnectionState()
      • udpPostSend()
      • udpPostReceive()
      • udpSetConnectionState()
    • PFObject
      • getType()
      • setType()
      • isReadOnly()
      • setReadOnly()
      • getStreamCount()
      • getStream()
      • clear()
      • clone()
      • detach()
      • free()
    • PFStream
      • seek()
      • read()
      • write()
      • size()
      • copyTo()
      • setEndOfStream()
      • reset()
    • PFHeader
      • addField()
      • removeFields()
      • getFields()
      • findFirstField()
      • findFields()
      • countFields()
      • size()
      • getField()
      • clear()
      • empty()
  • Filters
    • Generic flags (PF_FilterFlags)
    • TCP disconnect objects
    • FT_PROXY
    • FT_SSL
      • FF_SSL_SELF_SIGNED_CERTIFICATE
      • SSL exceptions
      • FF_SSL_INDICATE_EXCEPTIONS
      • FF_SSL_INDICATE_HANDSHAKE_REQUESTS
      • FF_SSL_DECODE_ONLY
      • FF_SSL_TLS_AUTO
      • FF_SSL_COMPATIBILITY
      • FF_SSL_VERIFY
      • FF_SSL_SUPPORT_CLIENT_CERTIFICATES
      • FF_SSL_INDICATE_SERVER_CERTIFICATES
      • FF_SSL_INDICATE_CLIENT_CERT_REQUESTS
      • FF_SSL_ENABLE_ALPN
      • FF_SSL_INDICATE_ALPN_SELECT_PROTOCOL
      • FF_SSL_KEEP_SERIAL_NUMBERS
      • FF_SSL_DONT_IMPORT_SELF_SIGNED
      • FF_SSL_DISABLE_TLS_1_0, FF_SSL_DISABLE_TLS_1_1
      • FF_SSL_TLS_COMPATIBILITY
      • FF_SSL_STRICT_VERIFICATION
      • FF_SSL_SCT_VERIFICATION
      • FF_SSL_ENABLE_OCSP_RESPONSES
      • FF_SSL_MORE_EXCEPTIONS
      • Known issues
    • FT_HTTP
      • FF_HTTP_KEEP_PIPELINING
      • FF_HTTP_DONT_UNCOMPRESS_CONTENT
      • QUIC protocol
      • HTTP/2
      • FF_HTTP_FILTER_WEBSOCKET
    • FT_HTTP2
      • FF_HTTP_DONT_UNCOMPRESS_CONTENT
      • FF_HTTP_INDICATE_INCOMPLETE_OBJECTS
      • QUIC protocol
    • FT_POP3
    • FT_SMTP
    • FT_FTP
    • FT_XMPP
    • FT_IMAP
    • FT_RAW